SERVICES AGREEMENT BETWEEN

THE TEXAS A&M UNIVERSITY SYSTEM AND

DELOITTE CONSULTING LLP

This Services Agreement (“Agreement”) is made and entered into and effective upon final execution of this Agreement (the “Effective Date”), by and between The Texas A&M University System, an agency of the state of Texas (“A&M System”) and Deloitte Consulting LLP, a Delaware limited liability partnership (“Deloitte Consulting”), individually referred to as “Party” and collectively referred to as “the Parties”. A&M System and Deloitte Consulting agree as follows: 1. Scope of Work

1.1 Deloitte Consulting will perform the scope of work set forth in Exhibit A, Scope of Work, attached hereto and incorporated for all purposes, (“Work”) in accordance with the schedule for the Work set forth in Exhibit A. A&M System will comply with its obligations and responsibilities set forth in Exhibit A. At a minimum, the Work will meet the requirements of RFP01 CIO-15-003, Governance Framework (“RFP”), as modified by Exhibit A.

1.2 Deloitte Consulting will obtain, at its own cost, any and all applicable approvals,

licenses, filings, registrations and permits required by federal, state or local laws, regulations or ordinances, for the performance of the Work.

2. Term The term of this Agreement will begin on the Effective Date and expire eight months after the Effective Date (“Expiration Date”), with the option to renew for up to an additional one year term upon mutual agreement of the parties, unless terminated earlier as provided in this Agreement or unless the Parties agree in wiring that an extension of the Expiration Date is necessary to complete the Work. 3. Deloitte Consulting’s Obligations

3.1 Deloitte Consulting confirms that neither Deloitte Consulting nor any subcontractor represented by Deloitte Consulting, or anyone acting for the subcontractor (1) has violated the antitrust laws of the state of Texas, Chapter 15, Texas Business and Commerce Code, or federal antitrust laws, or (2) has communicated directly or indirectly the content of Deloitte Consulting’s response to A&M’s procurement solicitations to any competitor or any other person engaged in a similar line of business during the procurement process for this Agreement, in connection with the Work hereunder.

3.2 Deloitte Consulting will perform the Work in accordance with applicable professional standards and in compliance with all applicable federal and state laws, in each case, in all material respects.

3.3 Deloitte Consulting represents that the partners or directors of Deloitte Consulting

directly in charge of the Work are duly registered and/or licensed under all applicable federal, state and local laws regulations, and ordinances.

3.4 Deloitte Consulting represents at (i) it is a Delaware limited liability partnership,

(ii) it has all necessary power and has secured all necessary approvals to execute and deliver this Agreement and perform all its obligations hereunder; and (iii) the individual executing this Agreement on behalf of Deloitte Consulting has been duly authorized to act for and bind Deloitte Consulting.

3.5 Deloitte Consulting represents that neither the execution and delivery of this

Agreement by Deloitte Consulting nor the performance of its duties and obligations under this Agreement will result in the violation of any provision of any partnership agreement by which Deloitte Consulting is bound, or to the best of Deloitte Consulting’s knowledge and belief, will conflict with any order or decree of any court or governmental instrumentality relating to Deloitte Consulting.

3.6 This is a services engagement. Deloitte Consulting warrants that it shall perform the Work hereunder in accordance with applicable professional standards and rules. Except for the warranties set forth in this Section 3.6, Deloitte Consulting disclaims all other warranties, either express or implied, including, without limitation, warranties of merchantability and fitness for a particular purpose.

3.7 Notwithstanding the forgoing, it is understood and agreed that the Work may include

advice and recommendations from Deloitte Consulting to A&M System, but A&M System retains all authority as to how it implements such advice and recommendations; provided, however, the provisions in this Section 3.7 shall in no manner reduce or eliminate Deloitte Consulting’s responsibility that the Work provided to A&M System under this Agreement comply with all applicable laws, rules, and regulations.

3.8 A&M System shall cooperate with Deloitte Consulting in the performance by

Deloitte Consulting of the Work, including, without limitation, providing Deloitte Consulting with reasonable facilities and timely access to data, information, and personnel of A&M System. A&M System shall be responsible for the performance of its personnel and agents and for the accuracy and completeness of all data and information provided to Deloitte Consulting for purposes of the performance by Deloitte Consulting of the Work. A&M System acknowledges and agrees that Deloitte Consulting’s performance is partially dependent upon the timely and effective satisfaction of A&M System’s responsibilities hereunder and timely decisions and approvals of A&M System in connection with the Work. Deloitte Consulting shall be entitled to rely on all decisions and approvals provided by the

A&M System Chief Information Officer, the A&M System Project Manager, and the IT Governance Committee constituted by A&M System pursuant to Exhibit A. A&M System shall be solely responsible for, among other things: (a) making all A&M System management decisions and performing all A&M System management functions; (b) designating a competent management member to oversee the Work; (c) evaluating the adequacy and results of the Work; (d) accepting responsibility for all implementation of the results of the Work; and (e) establishing and maintaining internal controls, including, without limitation, monitoring ongoing activities.

4. Consideration

4.1 A&M System will pay Deloitte Consulting for the performance of the Work under Exhibit A an amount not to exceed $538,600.00. The amounts to be paid Deloitte Consulting under this Agreement include all of Deloitte Consulting’s expenses in performing the Work, including travel expenses, as well as all bills for labor and material performed and furnished by Deloitte Consulting’s subcontractors, if any, in connection with the performance of Deloitte Consulting’s obligations hereunder.

5. Payment Terms

5.1 For all work performed under Exhibit A, Deloitte Consulting will submit invoices to A&M System once Deliverables have been completed and accepted by A&M System in accordance with the terms of Section 10.21.

5.2 In the event of early termination of this Agreement by Deloitte Consulting for

A&M System’s breach of this Agreement prior to completion or acceptance of any Deliverables, A&M System will pay Deloitte Consulting (i) a pro-rata portion of the amount due for each such Deliverable, and (ii) all holdback amounts permitted to be retained by A&M System as set forth in Section 5.1, if any.

5.3 A&M System will pay each properly documented invoice in accordance with

Texas Prompt Pay laws.

5.4 If A&M System submits in advance a written request for additional services not included in the Work, and if Deloitte Consulting agrees to provide such services, Deloitte Consulting shall be paid for the performance of such services in an amount agreed upon by A&M System and Deloitte Consulting as evidenced by a mutually acceptable writing setting forth the additional services and compensation therefor executed by A&M System and Deloitte Consulting prior to the commencement of such services.

6. Ownership and Use of Work Material

6.1 Except as otherwise provided below, the tangible materials prepared by Deloitte Consulting or any subcontractors and specified as deliverables or work product in Exhibit A or which the Parties agree to in the performance of Exhibit A (“the

Deliverables”) are considered to be works for hire, and shall, upon A&M System’s full and final payment to Deloitte Consulting for such Deliverables hereunder, become the property of A&M System for its exclusive use, re-use, copying, and distribution (as permitted herein or as required by applicable law or regulation), at any time without further compensation and, except as otherwise provided herein, without any restrictions. A&M System may, at all times, retain the originals of the Deliverables.

6.2 To the extent that any Deloitte Consulting Technology (as defined below) is

contained in any of the Deliverables, Deloitte Consulting hereby grants A&M System, upon full and final payment to Deloitte Consulting hereunder, a royalty-free, fully paid-up, worldwide, nonexclusive, perpetual, non-cancelable and non-terminable license to use such Deloitte Consulting Technology in connection with the Deliverables. Deloitte Consulting has created, acquired, or otherwise has rights in, and may, in connection with the performance of the Work, employ, provide, modify, create, acquire, or otherwise obtain rights in, works of authorship, materials, information and other intellectual property (collectively, the “Deloitte Consulting Technology”).

6.3 The Deliverables will not be used or published by Deloitte Consulting or any

other party unless expressly authorized by A&M System in writing.

6.4 Except as otherwise provided in Section 10.20 or as otherwise required by applicable law, all Work and Deliverables shall be solely for A&M System’s benefit, and are not intended to be relied upon by any person or entity other than A&M System and A&M System shall not disclose the Work or Deliverables, or refer to the Work or Deliverables in any communication, to any person or entity except (i) as specifically set forth in Exhibit A; (ii) to A&M System’s contractors solely for the purpose of their providing services to A&M System relating to the subject matter of this Agreement, provided that such contractors comply with the restrictions on disclosure set forth in this sentence; or (iii) to the extent not prohibited by Texas law. A&M System, however, may create its own materials based on the content of such Work and Deliverables and use and disclose such A&M System-created materials for external purposes, provided that A&M System does not in any way, expressly or by implication, attribute such materials to Deloitte Consulting or its subcontractors. Nothing in this Agreement shall prevent A&M System from providing the Deliverables to other Texas state agencies (including the A&M System institutions and agencies).

6.5 Deloitte Consulting does not agree to any terms that may be construed as precluding or limiting in any way its right to

(1) provide consulting or other work of any kind or nature whatsoever to any person or entity as Deloitte Consulting in its sole discretion deems appropriate, so long as applicable law does not prohibit Deloitte Consulting’s performance of such consulting or work, or

(2) develop for itself, or for others, materials that are competitive with or similar to those produced as a result of the Work, irrespective of their similarity to the Work Material, so long as such materials do not include confidential information of or contain any information identifying A&M System or any of its personnel.

6.6 To the extent any Deloitte Consulting Technology provided to A&M System hereunder constitutes inventory within the meaning of section 471 of the Internal Revenue Code, such Deloitte Consulting Technology is licensed to A&M System by Deloitte Consulting as agent for Deloitte Consulting Product Services LLC on the terms and conditions set forth herein. Deloitte Consulting represents that it has received all necessary authority to license any such Deloitte Consulting Technology on behalf of Deloitte Consulting Product Services LLC. The assignment and license grant in this Section 6 do not apply to any Deloitte Consulting Technology (including any modifications or enhancements thereto or derivative works based thereon) that is subject to a separate license agreement between A&M System and a third party, including without limitation, Deloitte Consulting Product Services LLC.

7. Default and Termination

7.1 In the event of a material failure by a Party to this Agreement to perform in accordance with the terms of this Agreement (“default”), the other Party may terminate this Agreement upon thirty (30) days’ written notice of termination setting forth the nature of the material failure. The termination will not be effective if the material failure is fully cured prior to the end of the thirty-day period.

7.2 In addition, Deloitte Consulting may terminate this Agreement, or any part thereof,

immediately upon written notice to A&M System if it reasonably determines that (a) a governmental, regulatory, or professional entity (including, without limitation, the American Institute of Certified Public Accountants, the Public Company Accounting Oversight Board, or the Securities and Exchange Commission), or an entity having the force of law has introduced a new, or modified an existing, law, rule, regulation, interpretation, standard, or decision, the result of which would render Deloitte Consulting’s performance of such part(s) or all of the engagement illegal or otherwise unlawful or in conflict with independence or professional standards or rules, or (b) circumstances change such that A&M System or an affiliate thereof becomes an attest client of Deloitte & Touche LLP or an affiliate thereof such that Deloitte Consulting’s performance of any part of the engagement would be illegal or otherwise unlawful or in conflict with independence or professional standards or rule.

7.3 Termination under Sections 7.1 or 7.2 will not relieve either party from liability

for any default or breach under this Agreement or any other act or omission of such party.

7.4 TAMUS may terminate this Agreement at any time upon thirty (30) days prior notice to Deloitte Consulting.

8. Relationship of the Parties

For all purposes of this Agreement and notwithstanding any provision of this Agreement to the contrary, Deloitte Consulting is an independent contractor and is not a state employee, partner, joint venture, or agent of A&M System. Deloitte Consulting will not bind nor attempt to bind A&M System to any agreement or contract. As an independent contractor, Deloitte Consulting is solely responsible for all taxes, withholdings, and other statutory or contractual obligations of any sort, including workers’ compensation insurance. 9. Insurance A&M System insurance requirements are stated in Exhibit B, attached hereto. 10. Miscellaneous

10.1 Assignment and Subcontracting. Deloitte Consulting’s interest in this Agreement (including Deloitte Consulting’s duties and obligations under this Agreement, and the fees due to Deloitte Consulting under this Agreement) may not be subcontracted, assigned, delegated, or otherwise transferred to a third party, in whole or in part, and any attempt to do so will (a) not be binding on A&M System; and (b) be a breach of this Agreement for which Deloitte Consulting will be subject to all remedial actions provided by Texas law. Notwithstanding the foregoing, A&M System hereby consents to Deloitte Consulting utilizing the affiliates or related entities set forth in Exhibit A, or other affiliates or related entities identified by Deloitte Consulting and agreed to by A&M System in writing.

10.2 Delinquent Child Support Obligations. A child support obligor who is more than

30 days delinquent in paying child support and a business entity in which the obligor is a sole proprietor, partner, shareholder, or owner with an ownership interest of at least 25 percent is not eligible to receive payments from state funds under an agreement to provide property, materials, or services until all arrearages have been paid or the obligor is in compliance with a written repayment agreement or court order as to any existing delinquency. The Texas Family Code requires the following statement be included in this Contract, which is certified by the signatory of the vendor hereto: “Under Section 231.006, Texas Family Code, the vendor or applicant certifies that the individual or business entity named in this contract, bid, or application is not ineligible to receive the specified grant, loan, or payment and acknowledges that this contract may be terminated and payment may be withheld if this certification is inaccurate.”

10.3 Payment of Debt or Delinquency to the State. Pursuant to Section 2252.903, Texas Government Code, Deloitte Consulting agrees that any payments owing to Deloitte Consulting under this Agreement may be applied directly toward certain debts or delinquencies that Deloitte Consulting owes the State of Texas or any agency of the State of Texas regardless of when they arise, until such debts or delinquencies are paid in full.

10.4 Franchise Tax Certification. If Deloitte Consulting is a taxable entity subject to

the Texas Franchise Tax (Chapter 171, Texas Tax Code), then Deloitte Consulting certifies that it is not currently delinquent in the payment of any franchise (margin) taxes or that Deloitte Consulting is exempt from the payment of franchise (margin) taxes.

10.5 Prohibited Bids and Agreements. A state agency may not accept a bid or award a

contract that includes proposed financial participation by a person who received compensation from the agency to participate in preparing the specifications or request for proposals on which the bid or contract is based. The Texas Government Code requires the following statement: “Under Section 2155.004, Texas Government Code, the vendor certifies that the individual or business entity named in this bid or contract is not ineligible to receive the specified contract and acknowledges that this contract may be terminated and payment withheld if this certification is inaccurate.”

10.6 Former Employees. Section 2252.901 of the Texas Government Code provides

that a state agency may not enter into an employment contract, a professional services contract under Chapter 2254, or a consulting services contract under Chapter 2254 with a former or retired employee of the agency before the first anniversary of the last date on which the individual was employed by the agency, if appropriated money will be used to make payments under the contract.

10.7 Tax Exempt Status. As an agency of the State of Texas, A&M System is tax

exempt. Tax exemption certification will be furnished upon request.

10.8 Products and Materials Produced in Texas. A&M System and Deloitte Consulting agree that the Work does not require the purchase of products and materials. However, should the Work be amended to require the purchase or products or materials, Deloitte Consulting agrees that in accordance with Section 2155.4441, Texas Government Code, in performing its duties and obligations under this Agreement, Deloitte Consulting will to the extent practicable purchase products and materials produced in Texas when such products and materials are available at a price and time comparable to products and materials produced outside of Texas.

10.9 Public Information. To the extent that in connection with this Agreement, A&M

System comes into possession of any trade secrets or other proprietary or confidential information of Deloitte Consulting that is marked as “proprietary” or

“confidential” (collectively, “Consultant Records”), A&M System will, hold such Consultant Records in confidence and will not use or disclose such Consultant Records except (a) as permitted or required by this Agreement, (b) as required by law, rule, regulation or judicial or administrative process, or in connection with litigation pertaining hereto or in accordance with applicable professional standards or rules, (c) to the extent such records (i) are or become publicly available other than as the result of a disclosure by A&M System in breach hereof, (ii) are already known by A&M System without any obligation of confidentiality with respect thereto, or (iii) are developed by A&M System independently of any disclosures made to University hereunder, or (d) as otherwise authorized by Deloitte Consulting in writing. Deloitte Consulting acknowledges that A&M System is obligated to strictly comply with the Public Information Act, Chapter 552, Texas Government Code, in responding to any request for public information pertaining to this Agreement.

10.10 Governing Law and Venue. The substantive laws of the State of Texas (and not

its conflicts of law principles), USA, govern all matters arising out of or relating to this Agreement and all of the transactions it contemplates. Pursuant to Section 85.18 (b), Texas Education Code, venue for a state court suit filed against The Texas A&M University System, any component of The Texas A&M University System, or any officer or employee of The Texas A&M University System is in the county in which the primary office of the chief executive officer of the system or component, as applicable, is located. At execution of this Agreement, such county is Brazos County, Texas. Venue for any suit brought against The Texas A&M University System in federal court must be in the Houston Division of the Southern District of Texas.

10.11 Loss of Funding. Performance by A&M System under this Agreement may be

dependent upon the appropriation and allotment of funds by the Texas State Legislature (the “Legislature”). If the Legislature fails to appropriate or allot the necessary funds, A&M System will issue written notice to Deloitte Consulting and A&M System may terminate this Agreement without further duty or obligation hereunder. Deloitte Consulting acknowledges that appropriation of funds is beyond the control of A&M System.

10.12 State Auditor’s Office. Deloitte Consulting understands that acceptance of funds

under this Agreement constitutes acceptance of the authority of the Texas State Auditor's Office, or any successor agency (collectively, “Auditor”), to conduct an audit or investigation in connection with those funds pursuant to Section 51.9335(c), Texas Education Code. Deloitte Consulting agrees to cooperate with the Auditor in the conduct of the audit or investigation, including without limitation, providing all records requested. Deloitte Consulting will include this provision in all contracts with permitted subcontractors other than affiliates or related entities of Deloitte Consulting.

10.13 Force Majeure. Neither party is required to perform any term, condition, or covenant of this Agreement or will be liable or responsible to the other for any loss or damage or for any delays or failure to perform, if performance is prevented or delayed by a natural occurrence, a fire, an act of God, an act of terrorism, or other similar occurrence, or other causes beyond the reasonable control of such party.

10.14 Non-Waiver. Deloitte Consulting expressly acknowledges that A&M System is

an agency of the State of Texas and nothing in this Agreement will be construed as a waiver or relinquishment by A&M System of its right to claim such exemptions, privileges, and immunities as may be provided by law. Further, no delay or omission in exercising any right accruing upon a default in performance of this Agreement will impair any right or be construed to be a waiver of any right. A waiver of any default under this Agreement will not be construed to be a waiver of any subsequent default under this Agreement.

10.15 Notices. Any notice required or permitted under this Agreement must be in

writing, and shall be deemed to be delivered when deposited with the United States Postal Service, postage prepaid, certified mail, return receipt requested, and addressed to the intended recipient at the address set out below. Notice may also be given by regular mail, personal delivery, courier delivery, facsimile transmission, or email and will be effective when actually received. A&M System and Deloitte Consulting can change their respective notice address by sending to the other party a notice of the new address. Notices should be addressed as follows:

A&M System: The Texas A&M University System 301 Tarrow St. College Station, Texas 77840 Attention: Jeff Zimmermann Phone: (979) 458-6410 Fax: (979) 458-6250 E-mail: jzimmermann@tamus.edu

Deloitte Consulting: Deloitte Consulting LLP 400 West 15th Street, Suite 1700 Austin, TX 78701 Attention: Scott Huntsman Phone: (832) 771-4936 E-mail: shuntsman@deloitte.com

10.16. Dispute Resolution. The dispute resolution process provided for in Chapter 2260, Texas Government Code, shall be used, as further described herein, by A&M System and Deloitte Consulting to attempt to resolve any claim for breach of contract made by Deloitte Consulting:

(A) Deloitte Consulting’s claims for breach of this Agreement that the parties cannot resolve in the ordinary course of business shall be submitted to the negotiation process provided in Chapter 2260, subchapter B, Texas Government Code. To initiate the process, Deloitte Consulting shall submit written notice, as required by subchapter B, to Billy Hamilton, Executive Vice Chancellor and Chief Financial Officer. Said notice shall specifically state that the provisions of Chapter 2260, subchapter B, are being invoked. A copy of the notice shall also be given to all other representatives of Deloitte Consulting and A&M System otherwise entitled to notice under this Agreement. Compliance by Deloitte Consulting with subchapter B is a condition precedent to the filing of a contested case proceeding under Chapter 2260, subchapter C, Texas Government Code.

(B) The contested case process provided in Chapter 2260, subchapter C, Texas Government Code, is Deloitte Consulting’s sole and exclusive process for seeking a remedy for any and all alleged breaches of contract by A&M System if the parties are unable to resolve their disputes under subparagraph (A) of this paragraph.

(C) Compliance with the contested case process provided in subchapter C is a condition precedent to seeking consent to sue from the Legislature under Chapter 107 of the Texas Civil Practices and Remedies Code. Neither the execution of this Agreement by A&M System nor any other conduct of any representative of A&M System relating to this Agreement shall be considered a waiver of sovereign immunity to suit. The submission, processing and resolution of Deloitte Consulting’s claim is governed by the published rules adopted by the Office of the Attorney General pursuant to Chapter 2260, as currently effective, hereafter enacted or subsequently amended. These rules are found at 1 T.A.C. Part 3, Chapter 68.

Neither the non-occurrence nor occurrence of an event nor the pendency of a claim constitutes grounds for the suspension of performance by Deloitte Consulting, in whole or in part; provided, however, that the foregoing shall not limit Deloitte Consulting’s rights to terminate this Agreement as set forth herein.

10.17 Limitations. The Parties are aware that there are constitutional and statutory

limitations on the authority of A&M System (a state agency) to enter into certain terms and conditions of this Agreement, including, but not limited to, those terms and conditions relating to liens on A&M System’s property; disclaimers and limitations of warranties; disclaimers and limitations of liability for damages; waivers, disclaimers and limitations of legal rights, remedies, requirements and processes; limitations of periods to bring legal action; granting control of litigation or settlement to another party; liability for acts or omissions of third parties; payment of attorneys’ fees; dispute resolution; indemnities; and confidentiality (collectively, the “Limitations”), and terms and conditions related to the Limitations will not be binding on A&M System except to the extent

authorized by the Constitution and the laws of the State of Texas. Neither the execution of this Agreement by A&M System nor any other conduct, action, or inaction of any representative of A&M System relating to this Agreement constitutes or is intended to constitute a waiver of A&M System’s or the state’s sovereign immunity to suit. The parties recognize that this Agreement is subject to, and agree to comply with, all applicable local, state, and federal laws, statutes, rules and regulations. Any provision of any law, statute, rule or regulation that invalidates any provision of this Agreement, that is inconsistent with any provision of this Agreement, or that would cause one or both of the parties hereto to be in violation of law will be deemed to have superseded the terms of this Agreement. The parties, however, will use their best efforts to accommodate the terms and intent of this Agreement to the greatest extent possible consistent with the requirements of the law and negotiate in good faith toward amendment of this Agreement in such respect.

10.18 Entire Agreement; Modifications. This Agreement, including its attachments,

together with RFP01 CIO-15-003, Governance Framework, and Deloitte Consulting’s Proposal in response to RFP01 CIO-15-003, Governance Framework, in such order of precedence and together with all supplements and addenda, supersedes all prior agreements, written or oral, between Deloitte Consulting and A&M System and will constitute the entire agreement and understanding between the Parties with respect to the subject matter of this Agreement. In the event of conflicts or inconsistencies between this Agreement and the proposal documents, such conflicts or inconsistencies shall be resolved by reference to the documents in the following order of precedence:

A. Service Agreement B. Attachments to Service Agreement

C. RFP01 CIO-15-003, Governance Framework, including all addenda, clarifications, revised offers and responses to questions

D. Deloitte Consulting’s Response to RFP01 CIO-15-003, Governance Framework, including all addenda, clarifications, revised offers and responses to questions

This Agreement and each of its provisions will be binding upon the parties and

may not be waived, modified, amended or altered except by a writing signed by both A&M System and Deloitte Consulting.

10.19 Captions. The captions of sections and subsections in this Agreement are for

convenience only and will not be considered or referred to in resolving questions of interpretation or construction.

10.20 Confidentiality and Safeguarding of A&M System Records; Press Releases;

Public Information. Under this Agreement Deloitte Consulting may (1) create, (2) receive from or on behalf of A&M System, or (3) have access to records belonging to A&M System (collectively A&M System Records”). Among other

things, A&M System Records may contain social security numbers, credit card numbers, data protected or made confidential or sensitive by applicable federal and state laws, including the Gramm-Leach-Bliley Act (Public Law No: 106-102) and the Family Education Rights and Privacy Act, 20 U.S.C §1232g (“FERPA”), or information relating to computer network security or to the design, operation, or defense of a computer network which is exempt from public disclosure pursuant to Section 552.139 of the Texas Government Code. If Deloitte Consulting requires access to any A&M System Records that are subject to FERPA in connection with any Work hereunder, A&M System shall designate an A&M System official with a legitimate educational interest in such A&M System Records with the responsibility for providing such access to Deloitte Consulting. Deloitte Consulting agrees that it will: (1) hold A&M System Records in confidence and will not use or disclose A&M System Records except (a) as permitted or required by this Agreement, (B) as required by law, rule, regulation or judicial or administrative process, or in connection with litigation pertaining hereto, or in accordance with applicable professional standards or rules, (c) to the extent such records (i) are or become publically available other than as the result of a disclosure by Deloitte Consulting in breach hereof, (ii) are already known by Deloitte Consulting without any obligation of confidentiality with respect thereto, or (iii) are developed by Deloitte Consulting independently of any disclosures made to Deloitte Consulting hereunder, or (d) as otherwise authorized by A&M System in writing; (2) safeguard A&M System Records by implementing reasonable administrative, physical and technical standards designed to protect against the unauthorized disclosure of any A&M System Records that are no less rigorous than the standards by which Deloitte Consulting protects its own confidential information; (3) regularly monitor its operations and take reasonable measures to safeguard the confidentiality of A&M System Records in accordance with all federal and state laws that are applicable to Deloitte Consulting in connection with the performance of the Work, including, if and to the extent so applicable, FERPA and the Gramm-Leach-Bliley Act, and the terms of this Section 10.20; and (4) ensure that A&M System Records are not outsourced or housed outside the United States other than to subcontractors permitted hereunder without prior A&M System authorization; and (5) comply with A&M System’s policies, regulations, rules and procedures regarding access to and use of A&M System’s computer systems set forth in A&M System Policy 29.01 - Information Resources accessible at http://www.tamus.edu/offices/policy/policies/, to the extent applicable to Deloitte Consulting it its performance of the Work. Attached hereto as Exhibit C is Deloitte Consulting’s Data Security Statement which includes a written description of the measures Deloitte Consulting has implemented to safeguard and maintain the confidentiality of personally identifiable information. A&M System hereby consents to Deloitte Consulting disclosing and A&M System Records to its subcontractors, affiliates or related entities that are performing Work in connection with the Agreement, if any, and who are bound by confidentiality obligations similar to this in this Section 10.20.

10.20.1 Notice of Unauthorized Use. If an unauthorized use or disclosure of any A&M System Records under Deloitte Consulting’s control occurs, Deloitte Consulting will provide written notice to A&M System immediately, but no more than three (3) business days after Deloitte Consulting’s discovery of such unauthorized use or disclosure. Deloitte Consulting will promptly provide A&M System with all reasonable information requested by A&M System regarding such unauthorized use or disclosure.

10.20.2 Return of A&M System Records. Deloitte Consulting agrees that

within thirty (30) days after the expiration or termination of this Agreement, Deloitte Consulting shall destroy all A&M System Records then in Deloitte Consulting’s possession, including all A&M System Records provided to Deloitte Consulting’s employees, subcontractors, agents, or other affiliated persons or entities, unless directed in writing to return such records to A&M System with no copies retained by Deloitte Consulting or if return is not feasible, destroyed. Twenty (20) days before destruction of any A&M System Records, Deloitte Consulting will provide A&M System with written notice Deloitte Consulting’s intent to destroy A&M System Records. Within five (5) days after destruction, Deloitte Consulting will confirm to A&M System in writing the destruction of A&M System records. Notwithstanding the foregoing, Deloitte Consulting shall have the right to retain copies of any A&M System Records for archival purposes to evidence Deloitte Consulting’s Work, provided further that such A&M System Records shall continue to be subject to the terms of this Agreement.

10.20.3 Disclosure. If Deloitte Consulting discloses any A&M System

Records to any of its subcontractors or agents permitted hereunder, Deloitte Consulting will require that such subcontractors or agents comply with this Section 10.20.

10.20.4 Press Releases. Except when defined as part of the Work, Deloitte

Consulting will not make any press releases, public statements, or advertisement referring to the Project or the engagement of Deloitte Consulting as an independent contractor of A&M System in connection with the Project, or release any information relative to the Project for publication, advertisement or any other purpose without the prior written approval of A&M System. The foregoing shall not prohibit Deloitte Consulting from (a) referring to A&M System generally in the media as a client or including A&M System in its general client lists, or (b) releasing information pertaining to the Work or the engagement of Deloitte Consulting hereunder as may be required by law, rule, regulation or judicial or

administrative process, or in accordance with applicable professional standards or rules.

10.20.5 Termination. In addition to any other termination rights set forth

in this Agreement and any other rights at law or equity, if Deloitte Consulting has breached any of its obligations set forth in this Section 10.20 resulting in an unauthorized disclosure of A&M System Records, A&M System may, upon written notice to Deloitte Consulting, immediately terminate this Agreement without opportunity to cure. Deloitte Consulting will be entitled to payment of any amount that will compensate Deloitte Consulting for the Work performed from the time of the last payment date to the termination date in accordance with this Agreement.

10.20.6 Duration. Deloitte Consulting’s obligations under this Section

10.20 will survive expiration or termination of this Agreement for any reason.

10.21 Acceptance of Deliverables. All Deliverables shall be provided to and reviewed by A&M System consistent with the Project schedule agreed to by the parties in writing (the “Schedule”). A&M System shall approve each Deliverable that conforms in all material respects with the specifications therefor set forth in Exhibit A or as otherwise agreed by the parties in writing (“Specifications”). A&M will review the Deliverables and notify Deloitte Consulting within the time period set forth in the Schedule regarding any non-acceptance. Any notice of non-acceptance will state in reasonable detail how the Deliverables did not conform to their applicable Specifications and Deloitte Consulting shall use its reasonable business efforts to correct such any deficiencies in the Deliverables so that they conform to the their applicable Specifications. All payments owing by A&M System to Deloitte Consulting hereunder will become due and payable if A&M System does not deliver a notice of non-acceptance to Deloitte Consulting prior to the expiration of any period for A&M System review or re-review as set forth in this section.

10.22 Binding Effect. This Agreement will be binding upon and inure to the benefit of

the Parties hereto and their respective permitted assigns and successors.

10.23 Records. Records relating to payments made to Deloitte Consulting, including reimbursable expenses pertaining to the Work will be available to A&M System or its authorized representative during reasonable business hours and will be retained for seven (7) years after final payment or abandonment of the Work. The foregoing right to inspect Deloitte Consulting’s billing records shall not include any confidential or proprietary information of Deloitte Consulting or its subcontractors or their respective personnel, except to the extent that Deloitte Consulting is required to make such billing records available for inspection under applicable law.

10.24 Severability. In case any provision of this Agreement will, for any reason, be held invalid or unenforceable in any respect, the invalidity or unenforceability will not affect any other provision of this Agreement, and this Agreement will be construed as if the invalid or unenforceable provision had not been included.

10.25 Indemnification and Hold Harmless. Deloitte Consulting shall defend, indemnify

and hold harmless A&M System, its officers, employees, agents, and Board of Regents against any and all claims of third parties for (i) bodily injury, death or damage to real or tangible personal property to the extent caused by the negligence of Deloitte Consulting while engaged in the performance of the Work under this Agreement; or (ii) infringement by a Deliverable of any U.S. patent existing at the time of delivery, or copyright or any unauthorized use of any trade secret, except to the extent that such infringement or unauthorized use arises from, or could have been avoided except for (i) modification of the Deliverable other than by Deloitte Consulting or its subcontractors, or use thereof in a manner not contemplated by this Agreement, (ii) the failure of the indemnified party to use any corrections or modifications made available by Deloitte Consulting, (iii) information, materials, instructions, specifications, requirements or designs provided by or on behalf of the indemnified party, or (iv) the use of the Deliverable in combination with any platform, product, network or data not provided by Deloitte Consulting. If A&M System’s use of any such Deliverable, or any portion thereof, is or is likely to be enjoined by order of a court of competent jurisdiction as such an infringement or unauthorized use, Deloitte Consulting, at its option and expense, shall have the right to (x) procure for A&M System the continued use of such Deliverable, (y) replace such Deliverable with a non-infringing Deliverable, or (z) modify such Deliverable so it becomes non-infringing; provided that, if (y) or (z) is the option chosen by Deloitte Consulting, the replacement or modified Deliverable is capable of performing substantially the same function. In the event Deloitte Consulting cannot reasonably procure, replace or modify such Deliverable in accordance with the immediately preceding sentence, Deloitte Consulting may require A&M System to cease use of such Deliverable and refund the professional fees paid to Deloitte Consulting with respect to the Services giving rise to such Deliverable. The foregoing provisions of this paragraph constitute the sole and exclusive remedy of the indemnified parties, and the sole and exclusive obligation of Deloitte Consulting, relating to a claim that any of Deloitte Consulting's Deliverables infringes any patent, copyright or other intellectual property right of a third party. As a condition to the indemnity obligations contained herein, A&M System shall provide Deloitte Consulting with prompt notice of any claim for which indemnification shall be sought hereunder and shall cooperate in all reasonable respects with the indemnifying party in connection with any such claim. Subject to the statutory duties of the Texas Attorney General, Deloitte Consulting shall be entitled to control the handling of any such claim and to defend or settle any such claim. Deloitte Consulting will only agree to any settlement that places any obligation on A&M System after approval from the Texas Office of the Attorney General.

10.26 Deloitte Consulting’s Liability. Deloitte Consulting will be responsible for costs of repairs for damage to buildings or other A&M System tangible personal property to the extent caused by the negligence of Deloitte Consulting’s employees while engaged in the performance of the Work under this Agreement.

10.27 Survival of Provisions. No expiration or termination of this Agreement will

relieve either Party of any obligations under this Agreement by their nature survive expiration or termination, including Sections 10.10, 10.11, 10.12, 10.14, 10.16, 10.17, 10.20, 10.22, 10.25, 10.26 and 10.28.

10.28 Limitation of Liability. A&M System agrees that Deloitte Consulting, its

subsidiaries and subcontractors, and their respective personnel will not be liable to A&M System for any claims, liabilities, or expenses relating to this Agreement (“Claims”) for an aggregate amount in excess of the fees paid by A&M System to Deloitte Consulting pursuant to this Agreement, except to the extent resulting from the bad faith or intentional misconduct of Deloitte Consulting. In no event will Deloitte Consulting, its subsidiaries or subcontractors, or their respective personnel be liable to A&M System for any loss of use, data, goodwill, revenues, or profits (whether or not deemed to constitute a direct Claim), or any consequential, special, indirect, incidental, punitive or exemplary loss, damage, or expense relating to this Agreement. The provisions of this Section shall not apply to any Claim for which Deloitte Consulting has an express obligation to indemnify A&M System under this Agreement. This paragraph will be effective to the extent authorized by the Constitution and laws of the State of Texas. The term “authorized” in the previous sentence means authorized expressly or authorized implicitly within the scope of authority granted to A&M System pursuant to an authorized power under, or not otherwise prohibited by, the Constitution or laws of the State of Texas.

10.29 HIPPA Compliance. If Deloitte Consulting will need access to PHI in connection with the Work hereunder, Deloitte Consulting agrees that it will execute a mutually agreed upon HIPAA Business Associate Agreement (“BAA”) with each institution if required so that HIPAA compliance is achieved.

10.30 Historically Underutilized Business Subcontracting Plan. Subcontracting opportunities are not anticipated for this Agreement, therefore a HUB Subcontracting Plan is not required. If there is a change and the parties agree that a subcontractor will be used to provide any commodity or service as part of the scope on a specific assignment, Deloitte Consulting will be required to make a good faith effort to solicit HUBs and complete the state of Texas HSP found at http://www.tamus.edu/business/facilities-planning-construction/forms-guidelines-wage-rates/. In the event that you determine you will be using a subcontractor, please contact Mr. Jeff Zimmermann from the A&M System’s HUB Program at (979) 458-6410 or jzimmermann@tamus.edu for assistance in determining available HUB subcontractors and proper completion of the HSP.

10.31 Multiple Counterparts. This Agreement may be executed by each of the parties in separate counterparts; each counterpart when so executed shall be deemed an original. When executed by all parties, such counterparts shall, together, constitute and be one and the same Agreement.

[Remainder of Page Intentionally Blank. Signature Page Follows]

EXHIBIT A – SCOPE OF WORK

1. SCOPE

Deloitte Consulting will work with A&M System to develop a governance framework that can be used to create new IT governance structures at member universities and agencies, to include Texas A&M System Offices, Texas A&M Sponsored Research Services, Texas A&M Technology Commercialization, Texas A&M University (inclusive of the Texas A&M Health Science Center and Texas A&M at Galveston), Texas A&M AgriLife Extension Service, Texas A&M AgriLife Research, Texas A&M Engineering Experiment Station, Texas A&M Engineering Extension Service, Texas A&M Transportation Institute, Texas A&M Forest Service, Texas A&M Veterinary Medical Diagnostic Laboratory, Prairie View A&M University, Texas A&M University-Commerce, Tarleton State University, West Texas A&M University, Texas A&M University-Kingsville, Texas A&M University-Corpus Christi, Texas A&M International University, Texas A&M University-Texarkana, Texas A&M University-San Antonio, and Texas A&M University-Central Texas.

2. PROJECT INTRODUCTION In response to a System-wide IT assessment and audit conducted by Deloitte Consulting LLP and recommendations of the Chancellor of The Texas A&M University System, the Chief Information Officer (CIO) of The Texas A&M University System (“TAMUS”) has completed a preliminary overview for a new IT Governance structure across the System. The objective of this Agreement is the implementation of a governance framework that can be used to enhance IT governance structures at member universities and agencies. A&M System requires that the definition and implementation of the governance framework be divided into several phases, as outlined below. Definition and Implementation of IT Governance: Phase 1 – Finalize the A&M System Governance Framework and Develop a Pilot and Rollout Strategy Phase 2 – Pilot – Governance at System Office and subset of members (no more than 3 members in addition to the System Office) Phase 3 – Rollout – Governance System-wide

3. PROJECT DESCRIPTION

1) Scope of Work & Overview

This Scope of Work contains common terms of governance, governance structures, capabilities and tools for governance, metrics, and a governance framework roll-out strategy.

Deloitte Consulting will be responsible for reviewing the initial IT Governance model developed by the A&M System, working with the IT Governance development team to finalize the governance framework and creating a strategy for implementing the IT Governance model at each member of The Texas A&M University System.

The development team is in the process of defining a new IT Governance framework with the following elements:

• Purpose • Minimum roles needed • Characteristics of projects that will be reviewed by System Governance • Minimum information and metrics (i.e., project dashboard) that will be provided

by projects • Scope of decisions that will be made by each IT Governance Committee,

including the process for prioritizing projects • IT Governance Committee meeting timing and structure

Deloitte Consulting should be familiar with the IT governance approach recommended by P. Weill and J Ross in IT Governance: How Top Performers Manage IT Decision Rights for Superior Results (Boston: Harvard Business School Press, 2004) to be able to integrate their recommendations with the new IT Governance framework being defined.

The new draft IT governance framework for the A&M System is shown below in Figure 1:

CATIE = Texas A&M System Council for Academic Technology and Innovative Education BAM = Buy A&M eProcurement system BPP = HR/payroll system FAMIS = accounting system MAESTRO = research administration system

2) Assessment Assess the proposed revisions to the current IT Governance framework a) Initial Governance Framework Review – Evaluate the initial framework

developed by the IT Governance Development Team

3) Framework Recommendations Recommend changes to the draft A&M System IT Governance framework and propose common terms to be used System-wide; a) Structures and Processes – Identify committees and councils and the roles

required to successfully perform A&M System IT Governance b) Capabilities and Tools – Identify capabilities required to successfully perform

System IT Governance c) Metrics – Identify KPIs required to effectively perform A&M System IT

Governance d) Recommendations – Provide recommendations to update the A&M System IT

Governance Framework

4) Strategy Recommend a roadmap to deliver System-wide IT Governance as follows: a) Pilot Rollout Plan – Define the plan to roll-out A&M System IT Governance

to TAMUS and a subset of members b) System-wide Rollout Plan – Define the plan to roll-out A&M System IT

Governance to the remaining members

5) Value Add Services In addition to the approach and activities from Deloitte’s RFP response and reflected in this exhibit, Deloitte will create the Board Member Training Materials and deliver one session during the Pilot Phase and one session during the System-wide Rollout phase. No other services in the value added services will be addressed.

6) TAMUS Responsibilities TAMUS will provide timely feedback on Deliverables. Once submitted for review, TAMUS will provide comments on deliverables within 5 days. After 5 days, without a response from TAMUS, the deliverable is deemed accepted.

The assumptions submitted by Deloitte Consulting under its original response shall apply to this SOW and are as follows:

• TAMUS will provide qualified and knowledgeable resources to the project team with business and technical skills required for the project to be delivered within the mutually agreeable timeline

• TAMUS executive management will provide full sponsorship and support for this project, including approval of budget, resources, and timing

• TAMUS will not withhold or delay access to the TAMUS leadership, managers, employees, information, and systems/data that are required to deliver the scope of work

• Deloitte’s Response is submitted in accordance with the data available and provided by TAMUS at the time of the SOW

• TAMUS shall obtain all consents necessary from third parties required for Deloitte to perform its obligations hereunder

• Deloitte Consulting will have no responsibility for the performance of other contractors or vendors engaged by TAMUS, or delays caused by them, in connection with the RFP

• TAMUS is responsible for the contractual relationship with third parties and for ensuring that they cooperate with Deloitte

• TAMUS will assign a Project Manager to the project responsible for scheduling meetings with TAMUS resources, ensuring attendance, and participation

• Other existing and planned TAMUS initiatives, which are not defined to be within the scope of the project, will be managed by TAMUS in a manner which does not adversely affect the overall project timeline. Resource conflicts and issues, as well as availability/readiness of legacy systems, shall be promptly escalated and managed by the TAMUS Leadership

• It is understood and agreed that the Services may include advice and recommendations, but all decisions in connection with the implementation of such advice and recommendations shall be the responsibility of, and made by, the TAMUS

• Deloitte will not provide legal advice regarding our services nor will we provide assurance regarding the outcome of future audits or regulatory examination, compliance, or other regulatory action. The responsibility for legal issues with respect to these matters, such as reviewing deliverables and work product for legal implications, regulatory compliance, or anything related, will be TAMUS’ responsibility

• Payment for Services is based on the provision of each milestone Deliverable as set forth in this pricing section. Upon early termination of any resulting Contract to Deloitte, the TAMUS will pay a pro-rata amount of the applicable fee for each in-progress Deliverable for work performed by Deloitte in connection with such Deliverable through the effective date of termination

• In the event of any delays caused outside of Deloitte’s direct control, a change or deviation in scope, any failure of any assumptions, or the TAMUS fails to meet its obligations), Deloitte’s ability to perform as set forth herein may be adversely impacted and an equitable adjustment to scope, cost and schedule will be agreed to by the parties in a change order to account for the impact. If such change order is not mutually agreed to within fifteen (15) days of Deloitte’s notification to the TAMUS of such impact, Deloitte may suspend or terminate the Services upon written notice to the TAMUS

• TAMUS will limit sensitive information, such as PII, PHI, trade secrets and other information that it considers sensitive or highly confidential, it provides to Deloitte (or otherwise makes available to Deloitte) to only that which is reasonably necessary to allow Deloitte to provide the Services. Deloitte will provide TAMUS with a list of Deloitte personnel who are authorized to receive or have access to TAMUS sensitive information. Such list may be updated as needed. Any disclosure of sensitive information by TAMUS to Deloitte will utilize levels of information security and data encryption appropriate to maintain

security of TAMUS sensitive information being accessed by or transferred to Deloitte, and as required by applicable information protection laws

• TAMUS will establish a contingency plan to address inadvertent disclosure of TAMUS sensitive information to Deloitte. TAMUS will promptly notify Deloitte’s Project Director in the event it becomes aware that sensitive information has been disclosed to Deloitte inadvertently or otherwise

• TAMUS will develop a mutually agreeable set of data management controls specifying the processes, procedures and methods that will be used by the parties for the secure transfer, access, and exchange management of TAMUS sensitive information pertinent to the Services, intended to safeguard the confidentiality and security of the sensitive information. TAMUS will train its relevant personnel on any such data management approach

7) Payment Schedule Payments are deliverables based and are inclusive of time and expenses to carry out the activities defined in Section 3.4.1 in the Deloitte response.

Phase Deliverables Price Phase 1 (6 weeks) Rollout Strategy Roadmap

System Member Playbook v1 $114,200

Phase 2 (10 weeks) Health Check Report Out #1 System Member Playbook v2 Board Member Onboarding Materials Board Member Onboarding Facilitation

$203,750

$13,328

$7,322

Phase 3 (12 weeks) Health Check Report Out #2 Health Check Report Out #3 Health Check Report Out #4 Board Member Onboarding Facilitation

$64, 226 $64, 226 $64, 226

$7,322

Total (28 weeks) $538,600

EXHIBIT B

Insurance Requirements

Deloitte Consulting shall obtain and maintain, for the duration of this Agreement, the minimum insurance coverage set forth below. With the exception of Professional Liability (E&O), all coverage shall be written on an occurrence basis. All coverage shall be underwritten by companies authorized to do business in the State of Texas or eligible surplus lines insurers operating in accordance with the Texas Insurance Code and have a financial strength rating of A- or better and a financial strength rating of VII or better as measured by A.M. Best Company or otherwise acceptable to A&M System. By requiring such minimum insurance, A&M System shall not be deemed or construed to have assessed the risk that may be applicable to Deloitte Consulting under this Agreement. Deloitte Consulting shall assess its own risks and if it deems appropriate and/or prudent, maintain higher limits and/or broader coverage. Deloitte Consulting is not relieved of any liability or other obligations assumed pursuant to this Agreement by reason of its failure to obtain or maintain insurance in sufficient amounts, duration, or types. No policy will be canceled without unconditional written notice to A&M System by Deloitte Consulting at least ten days before the effective date of the cancellation.

Insurance: Coverage Limit A. Worker’s Compensation

Statutory Benefits (Coverage A) Statutory Employers Liability (Coverage B) $1,000,000 Each Accident $1,000,000 Disease/Employee $1,000,000 Disease/Policy Limit Workers’ Compensation policy must include under Item 3.A. on the information page of the workers’ compensation policy the state in which work is to be performed for A&M System. Workers’ compensation insurance is required, and no “alternative” forms of insurance will be permitted

B. Automobile Liability Business Auto Liability Insurance covering all owned, non-owned or hired automobiles, with limits of not less than $1,000,000 Combined Single Limit of liability per accident for Bodily Injury and Property Damage;

If a separate Business Auto Liability policy is not available, coverage for hired and non-owned auto liability may be endorsed on the Commercial General Liability policy.

Additional Endorsements The Auto and Commercial General Liability Policies shall include The Texas A&M University System Board of Regents for and on behalf of The Texas A&M University System as additional insureds.

C. Commercial General Liability Each Occurrence Limit $1,000,000 General Aggregate Limit $2,000,000 Products / Completed Operations $1,000,000 Personal / Advertising Injury $1,000,000

Damage to rented Premises $300,000 Medical Payments $5,000

The required commercial general liability policy will be issued on a form that insures Deloitte Consulting’s liability for bodily injury (including death), property damage, personal and advertising injury assumed under the terms of this Agreement.

D. Deloitte Consulting will deliver to A&M System: Evidence of insurance on a current version ACORD© certificate form verifying the existence and required limits of all insurance after the execution and delivery of this Agreement and prior to the performance of any services by Deloitte Consulting under this Agreement. Evidence of insurance will be provided on a current version ACORD© certificate form verifying the continued existence of all required insurance no later than thirty (30) days after each annual insurance policy renewal.

All insurance policies, with the exception of worker’s compensation, employer’s liability and professional liability will be endorsed to include The Board of Regents for and on behalf of The Texas A&M University System and The Texas A&M University System as Additional Insureds up to the actual liability limits of the policies maintained by Deloitte Consulting. Commercial General Liability and Business Auto Liability will be endorsed to provide primary and non-contributory coverage. The Commercial General Liability Additional Insured endorsement will be submitted with the Certificates of Insurance.

All insurance policies, with the exception of professional liability, will be endorsed to provide a waiver of subrogation in favor of The Board of Regents of The Texas A&M University System and The Texas A&M University System.

Deloitte Consulting is responsible to pay any deductible or self-insured retention for any loss.

Certificates of Insurance and Additional Insured Endorsements as required by this Agreement will be mailed, faxed, or emailed to the following A&M System contact in Section 10.15.

The insurance coverage required by this Agreement will be kept in force until all services have been fully performed and accepted by A&M System in writing, except as may be noted.

EXHIBIT C - SECURITY STATEMENT

Deloitte Consulting currently maintains physical, electronic and procedural safeguards that are designed to (1) protect the security and confidentiality of A&M System customer information, (2) protect against anticipated threats or hazards to the security or integrity of such information, and (3) protect against unauthorized access to or use of such information that could result in substantial harm or inconvenience to any customer of A&M System. Such safeguards include:

• Maintaining an information security program that defines, implements and reviews information security policies and procedures.

• Implementing policies that prohibit the unauthorized disclosure of, among other things, customer information, and requesting, on an annual basis, confirmation from Deloitte Consulting personnel that they have read such policies.

• Protecting the confidentiality of A&M System data by : o Implementing processes to encrypt data files stored on laptop and desktop

computers o Implementing processes and security settings to protect information stored on

mobile devices (e.g., BlackBerries® and Treos™), such as time out values, PINs, automatic device wipe after a specified number of invalid log-on attempts, and remote wipe capability.

o Issuing encrypted USB drives to Deloitte Consulting personnel for use in transferring confidential data

• Implementing training and awareness programs for Deloitte Consulting personnel related to information security policies, information protection standards, and privacy. Additionally, from time to time, publishing privacy and security-related alerts or reminders by standard internal communication channels.

• Limiting access to Deloitte Consulting offices through the use of one or more of the following:

o Conventional locks o Electronic locks o Security guards o Identification badges o Visitor control programs o Video surveillance programs

• Maintaining an anti-virus protection program. Such program includes: o Centrally managed, commercially available anti-virus software on Deloitte

Consulting computers to which updates are released as they become available from vendors

o A virus containment process that defines responsibilities and outlines procedures

• Maintaining Deloitte Consulting network servers in data centers that employ a variety of industry-accepted procedures and tools that are designed to safeguard portions of the network and servers within the data centers. These include combinations of the following:

o Restricting both physical and network access to those with a business need for access

o Restricting physical access to the data centers by card-key control systems o Implementing a network based intrusion detection system o Implementing firewalls to segment networks o Implementing security vulnerability assessment processes and tools o Implementing change management procedures o Implementing patch management processes and tools

• Periodically backing-up data that is maintained on Deloitte Consulting network servers, including processes to encrypt back-up media and to store back-up media off-site

• Limiting access to Deloitte Consulting computers and networks through the use of one or more of the following:

o User credentials o Access control lists o VPN rules o Firewall rules

• Implementing a disaster recovery/business continuity program. Such program includes: o Developing disaster recovery/business continuity plans and procedures o Developing back-up recovery processes that are designed to facilitate the

continuity of business functions o Reviewing, testing and updating aspects of disaster recovery/business continuity

plans

• From time to time, performing internal assessments of aspects of Deloitte Consulting information security policies and procedures.

From time to time, Deloitte Consulting may change the physical, electronic and procedural safeguards that it maintains. Deloitte Consulting shall not be under any obligation to notify University of any such change.